CVE-2021-25487
Samsung Mobile Devices Out-of-Bounds Read Vulnerability
Description
CVE-2021-25487 is an out-of-bounds read vulnerability in the modem interface driver of Samsung Android devices, specifically in the set_skb_priv() function. The lack of proper boundary checking on a buffer allows a local attacker with low privileges to read data beyond the intended memory boundaries, which can result in arbitrary code execution through the dereference of an invalid function pointer. This vulnerability was addressed in the Samsung SMR October 2021 Release 1 security update. CISA has confirmed active exploitation of CVE-2021-25487 by adding it to the Known Exploited Vulnerabilities catalog, and the EPSS score of 2.4% (85th percentile) indicates meaningful exploitation probability for Samsung mobile devices.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| samsung | android | 8.1; 9.0; 10.0; 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25487(US Government Resource)
Weakness Type
CWE-125: Out-of-bounds Read
In CVE-2021-25487, the Samsung modem interface driver's set_skb_priv() function fails to validate buffer boundaries before performing read operations, allowing data to be read from memory locations outside the allocated buffer. This out-of-bounds read in the modem driver can expose sensitive kernel memory contents and, critically, leads to the dereference of an invalid function pointer, enabling arbitrary code execution.
Learn more: CWE-125 — Out-of-bounds Read
Impact Analysis
CVE-2021-25487 carries a CVSS v3.1 score of 7.3 (High), with particularly concerning characteristics for mobile device security. The vulnerability is exploitable locally with low attack complexity and requires only low privileges, meaning a malicious application installed on the device could trigger the exploit without any user interaction. Notably, the scope is Changed, meaning the vulnerability can affect resources beyond the vulnerable modem driver component itself, potentially compromising the entire device kernel. Confidentiality impact is rated High, as the out-of-bounds read can expose sensitive kernel memory including cryptographic keys and authentication tokens, while integrity is rated Low, reflecting the potential for limited code execution through function pointer corruption. The EPSS score of 2.4% (85th percentile) combined with CISA's confirmed active exploitation demonstrates that this vulnerability is being targeted in real-world attacks against Samsung mobile devices.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-25487 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 20, 2023. No public proof-of-concept exploit code has been identified in the available references, suggesting that exploitation is conducted by advanced threat actors using privately developed exploits targeting Samsung mobile devices. The EPSS score of 2.4% (85th percentile) indicates that while not massively widespread, the exploitation probability is significantly above average, consistent with targeted attacks against mobile device modem firmware. The ransomware association is listed as unknown.
Remediation
- Apply Samsung security updates immediately as directed by CISA: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Samsung addressed this vulnerability in the SMR October 2021 Release 1.
- Update all affected Samsung Android devices to the October 2021 or later security patch level. Check the device security patch level under Settings > About Phone > Software Information and ensure it shows 2021-10-01 or later. Carrier-specific delays in patch distribution should be escalated with the carrier.
- Enforce mobile device management (MDM) policies that restrict installation of applications from unknown sources and implement application allowlisting to reduce the risk of malicious applications exploiting the modem interface driver vulnerability on unpatched devices.
- Monitor managed Samsung devices for signs of compromise including unexpected crashes, kernel panics related to the modem interface driver, unusual data exfiltration patterns, or indicators of privilege escalation that could suggest exploitation of the out-of-bounds read vulnerability.
- Implement network-level protections for managed mobile device fleets by monitoring for anomalous modem traffic patterns and ensuring that enterprise Samsung devices receive security updates promptly through automated MDM patch deployment.
Technical Details
CVE-2021-25487 is an out-of-bounds read vulnerability (CWE-125) in the set_skb_priv() function within Samsung's modem interface driver, a kernel-level component responsible for handling communication between the application processor and the cellular modem on Samsung Android devices. The function lacks proper boundary validation when reading from a buffer, allowing read operations to access memory beyond the allocated buffer's boundaries. This out-of-bounds read is particularly dangerous because the extraneous data read from adjacent memory can include function pointers, and when one of these corrupted pointers is subsequently dereferenced, it enables arbitrary code execution at the kernel privilege level. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) reflects that while local access and low privileges are required, the scope change to the broader kernel context and the high confidentiality impact make this a significant threat, particularly as the attack can be triggered by any application with basic permissions on the device.
Frequently Asked Questions
Is CVE-2021-25487 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2021-25487 by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 20, 2023. While no public exploit code is available, the confirmed exploitation indicates that advanced threat actors are targeting this vulnerability in Samsung mobile devices. The ransomware association is currently unknown.
What products are affected by CVE-2021-25487?
CVE-2021-25487 affects Samsung Android mobile devices running firmware versions prior to the SMR October 2021 Release 1 security update. The vulnerability is in the modem interface driver's set_skb_priv() function, which is common across Samsung's Android device lineup that uses their proprietary modem drivers.
How do I fix CVE-2021-25487?
The fix is to apply the Samsung SMR October 2021 Release 1 security update or any subsequent security patch. This can be done through Settings > Software Update on the affected device. Organizations managing Samsung device fleets should deploy the update through their MDM platform to ensure comprehensive patching.
How severe is CVE-2021-25487?
CVE-2021-25487 has a CVSS v3.1 score of 7.3, rated as High severity. The vulnerability allows a local attacker with low privileges to achieve arbitrary code execution through an out-of-bounds read that corrupts function pointers. Its EPSS score of 2.4% (85th percentile) and KEV catalog inclusion confirm meaningful real-world exploitation risk.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.